Data Protection Case - Next Stop Europe?

Michael Durant, who lost a landmark data protection case in the Court of Appeal, has been refused permission to appeal to the House of Lords.

The Data Protection Act 1998 (DPA) applies to ‘personal data’ held on computer and held manually, provided the manual data is organised into a ‘relevant filing system’.

Mr Durant had been involved in a dispute with Barclays Bank plc. Following unsuccessful litigation, he continued to try to get hold of documents which he evidently believed would help back up his claim. He sought information from the Financial Services Authority (FSA), which had carried out an investigation into his complaint against the bank, making two subject access requests. The FSA refused access to some manual files on the grounds that the information held was not personal, nor did it form part of a relevant filing system.

In deciding whether information relating to the FSA’s investigation into Mr Durant’s complaint constituted personal data, the Court of Appeal found that the purpose of the DPA is to enable individuals to check whether a data controller’s processing of personal information held about them infringes their privacy and, if it does, to enable them to take steps to protect it. The right of access is not an automatic right to any information, readily accessible or not, in which the individual may be named or involved. Therefore, the mere mention of the person in a document held by a data controller does not mean it is necessarily personal data.

The Court of Appeal also ruled that a relevant filing system, for the purposes of the DPA, only covers manual files if they are organised in such a way as to provide the same or similar ease of access to data as a computerised system.

In the light of the Court’s ruling, the Information Commissioner has issued revised guidance for employers on how to handle a request by an individual for data held on them. This is available on the Information Commissioner’s website.

This may not be the end of the matter however. There is every chance that the case will be brought before the European Court of Justice.